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What is Claimed is: 

1 . An apparatus for providing hot standby operation, said 
apparatus comprising: 

a normal processor; 
a standby processor; 

each of said normal and standby processors comprising: 

a plurality of vital inputs, at least some of said vital 

inputs being electrically interconnected with at least some of said vital inputs of the 

other one of said standby and normal processors, 

a plurality of vital outputs, 

means for communicating with the other one of said 
standby and normal processors, 

a health routine providing a health status after 
communication is established with the other one of said standby and normal 
processors through said means for communicating, 

a vital relay including an input controlled by one of said 
vital outputs and an output to one of said vital inputs of the other one of said standby 
and normal processors, 

a synchronization routine providing a synchronization 
status through said means for communicating with the other one of said standby and 
normal processors, and 

an application routine outputting said vital outputs when 
said synchronization status is set and inputting said vital inputs; 

said standby processor further comprising a reset routine, 
which resets said standby processor when said health status of said standby processor 
is not provided; and 

means for outputting from some of said vital outputs of said 
normal processor and from some of said vital outputs of said standby processor. 

2. The apparatus of Claim 1 wherein said normal and standby 
processors operate in at least one mode selected from the group comprising: 
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a first mode wherein both of said normal and standby 
processors output through at least one of said some of said vital outputs of said 
normal and standby processors, respectively, without restriction; 

a second mode wherein said normal processor outputs 
through at least one of said some of said vital outputs of said normal processor 
without restriction and said standby processor verifies through said means for 
communicating of said standby processor that said standby processor agrees with said 
normal processor before outputting through at least one of said some of said vital 
outputs of said standby processor and, otherwise, said standby processor being reset; 
and 

a third mode wherein both of said normal and standby 
processors verify through said means for communicating of said normal and standby 
processors, respectively, that said normal and standby processors, respectively, agree 
with said standby and normal processors, respectively, before outputting through at 
least one of said some of said vital outputs of said normal and standby processors, 
respectively, and, otherwise, said normal and standby processors being reset. 

3. The apparatus of Claim 2 wherein for said first mode the 
application routines of said normal and standby processors enable said some of said 
vital outputs of said normal and standby processors, respectively, if the output of said 
vital relay of said standby and normal processors, respectively, is set and if the health 
routine of said normal and standby processors, respectively, determines said health 
status. 

4. The apparatus of Claim 2 wherein for said second mode the 
application routine of said normal processor enables said some of said vital outputs of 
said normal processor if the output of said vital relay of said standby processor is set 
and if the health routine of said normal processor determines said health status. 

5. The apparatus of Claim 2 wherein for said second mode the 
application routine of said standby processor enables one of said some of said vital 
outputs of said standby processor if the output of said vital relay of said normal 
processor is set, if the health routine of said standby processor determines said health 
status, and if said standby processor verifies through said means for communicating 
of said standby processor that said one of said some of said vital outputs of said 
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standby processor agrees with a corresponding one of said some of said vital outputs 
of said normal processor. 

6. The apparatus of Claim 2 wherein for said third mode the 
application routines of said normal and standby processors enable one of said some of 
said vital outputs of said normal and standby processors, respectively, if the output of 
said vital relay of said standby and normal processors, respectively, is set, and if the 
health routine of said normal and standby processors, respectively, determines said 
health status, and if said normal and standby processors verify through said means for 
communicating of said normal and standby processors, respectively, that said one of 
said some of said vital outputs of said normal and standby processors, respectively, 
agrees with said standby and normal processors, respectively. 

7. The apparatus of Claim 1 wherein both of said normal and 
standby processors operate in a mode in which said normal and standby processors 
output through at least one of said some of said vital outputs of said normal and 
standby processors, respectively, without restriction. 

8. The apparatus of Claim 1 wherein said normal and standby 
processors operate in modes wherein said normal processor outputs through at least 
one of said some of said vital outputs of said normal processor without restriction and 
said standby processor verifies through said means for communicating of said standby 
processor that said standby processor agrees with said normal processor before 
outputting through at least one of said some of said vital outputs of said standby 
processor and, otherwise, said standby processor being reset. 

9. The apparatus of Claim 8 wherein the application routine of 
said standby processor enables one of said some of said vital outputs of said standby 
processor if the health routine of said standby processor determines said health status 
and if said standby processor verifies through said means for communicating of said 
standby processor that said one of said some of said vital outputs of said standby 
processor agrees with a corresponding one of said some of said vital outputs of said 
normal processor. 

1 0. The apparatus of Claim 8 wherein said some of said vital 
outputs of said normal and standby processors include signal lighting outputs. 
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1 1 . The apparatus of Claim 1 wherein said normal and standby 
processors operate in mode wherein both of said normal and standby processors verify 
through said means for communicating of said normal and standby processors, 
respectively, that said normal and standby processors, respectively, agree with said 
standby and normal processors, respectively, before outputting through at least one of 
said some of said vital outputs of said normal and standby processors, respectively, 
and, otherwise, said normal and standby processors are reset. 

1 2. The apparatus of Claim 1 1 wherein said some of said vital 
outputs of said normal and standby processors include lock outputs. 

13. The apparatus of Claim 12 wherein said lock outputs include a 
first lock output and a second lock output; wherein the first lock output of said normal 
processor is in agreement with the first lock output of said standby processor; wherein 
both of said first lock outputs are set to an unlocked state; wherein the second lock 
output of said normal processor is not in agreement with second lock output of said 
standby processor; and wherein both of said second lock outputs are set to a locked 
state. 

14. The apparatus of Claim 12 wherein said lock outputs include a 
first lock output and a second lock output; wherein the first lock output of said normal 
processor is in agreement with the first lock output of said standby processor; wherein 
both of said first lock outputs are set to a locked state; wherein the second lock output 
of said normal processor is not in agreement with second lock output of said standby 
processor; and wherein both of said second lock outputs are set to a locked state. 

1 5. The apparatus of Claim 2 wherein both of said normal and 
standby processors are operating and capable of outputting through said means for 
outputting to a single output device. 

16. The apparatus of Claim 1 5 wherein said means for outputting 
includes a first diode having an anode and a cathode and a second diode having an 
anode and a cathode; wherein said cathodes are adapted for electrical connection to 
said single output device; wherein the anode of said first diode is electrically 
connected to one of said some of said vital outputs of said normal processor; and 
wherein the anode of said second diode is electrically connected to a corresponding 
one of said some of said vital outputs of said standby processor. 
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17. The apparatus of Claim 1 5 wherein said means for outputting 
includes a first diode array having an input and an output and a second diode array 
having an input and an output; wherein said outputs of said first and second diode 
arrays are adapted for electrical connc * n to said single output device; wherein the 
input of said first diode array is electrically connected to one of said some of said vital 
outputs of said normal processor, and wherein the input of said second diode array is 
electrically connected to a corresponding one of said some of said vital outputs of said 
standby processor. 

1 8. The apparatus of Claim 1 7 wherein each of said first and 
second diode arrays includes a first pair of series-connected diodes and a second pair 
of series-connected diodes, said first pair of series-connected diodes being electrically 
connected in parallel with said second pair of series-connected diodes, said first and 
second pairs having a pair of anodes as the input of the corresponding one of said first 
and second diode arrays, said first and second pairs having a pair of cathodes as the 
output of the corresponding one of said first and second diode arrays. 

19. The apparatus of Claim 1 wherein said means for outputting 
includes a vital OR circuit having a first input from one of said some of said vital 
outputs of said normal processor, a second input from one of said some of said vital 
outputs of said standby processor, and an output adapted to output to a single output 
device. 

20. The apparatus of Claim 1 wherein said means for 
communicating includes at least one communication port adapted for communication 
with the other one of said standby and normal processors. 

2 1 . The apparatus of Claim 20 wherein said at least one 
communication port is at least one serial communication port. 

22. The apparatus of Claim 21 wherein said at least one serial 
communication port includes an output serial communication port for outputting serial 
data from one of said standby and normal processors to the other of said standby and 
normal processors, and further includes an input serial communication port for 
inputting serial data from the other one of said standby and normal processors to said 
one of said standby and normal processors. 
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23. The apparatus of Claim 1 wherein said normal and standby 
processors form an interlocking control system. 

24. The apparatus of Claim 1 wherein said health routine of said 
normal and standby processors periodically exchanges health information with said 
health routine of said standby and normal processors, respectively, in order to provide 
said health status when said one of said vital inputs of the other one of said standby 
and normal processors is set and said health information is periodically received. 

25. The apparatus of Claim 24 wherein said normal and standby 
processors operate in a mode wherein both of said normal and standby processors 
verify through said means for communicating of said normal and standby processors, 
respectively, that said normal and standby processors, respectively, agree with said 
standby and normal processors, respectively, before outputting through at least one of 
said some of said vital outputs of said normal and standby processors, respectively, 
and, otherwise, said normal and standby processors being reset; wherein the 
application routines of said normal and standby processors enable one of said some of 
said vital outputs of said normal and standby processors, respectively, if the output of 
said vital relay of said standby and normal processors, respectively, is set, and if the 
health routine of said normal and standby processors, respectively, determines said 
health status, and if said normal and standby processors verify through said means for 
communicating of said normal and standby processors, respectively, that said one of 
said some of said vital outputs of said normal and standby processors, respectively, 
agree with said standby and normal processors, respectively. 

26. The apparatus of Claim 24 wherein the health routine of said 
normal processor outputs a reset command to said standby processor whenever the 
input of said vital relay controlled by said one of said vital outputs of said normal 
processor is set and the synchronization routine of said normal processor loses said 
synchronization status; and wherein said reset routine of said standby processor 
employs said reset command to reset said standby processor. 

27. The apparatus of Claim 26 wherein said reset routine of said 
standby processor initially ignores said reset command when said synchronization 
status is not set. 



WO 2004/025469 



PCT/US2003/028149 



- 116- 

28. The apparatus of Claim 1 wherein said application routine 
outputs said vital outputs: (a) when said one of said vital inputs of the other one of 
said standby and normal processors is not set; and (b) when said one of said vital 
inputs of the other one of said standby and normal processors is set and said 
synchronization status is set. 

29. The apparatus of Claim 1 wherein said one of said vital inputs 
of both of said normal and standby processors is set; wherein said standby processor 
verifies through said means for communicating of said standby processor that said 
standby processor disagrees with said normal processor before outputting through at 
least one of said some of said vital outputs of said standby processor; and wherein 
said reset routine of said standby processor resets said standby processor. 

30. The apparatus of Claim 1 wherein said one of said vital inputs 
of both of said normal and standby processors is set; wherein said normal processor 
verifies through said means for communicating of said normal processor that said 
standby processor disagrees with said normal processor before outputting through at 
least one of said some of said vital outputs of said normal processor; and wherein said 
reset routine of said normal processor outputs a reset command through said means 
for communicating of said noimal processor to reset said standby processor. 

3 1 . The apparatus of Claim 1 wherein said synchronization routine 
of said normal and standby processors sets said synchronization status when said one 
of said vital inputs of the other one of said standby and normal processors, 
respectively, is set, and when said normal and standby processors, respectively, 
verifies through said means for communicating that said one of said some of said vital 
outputs of said normal and standby processors, respectively, agrees with the 
corresponding one of said some of said vital outputs of said standby and normal 
processors, respectively. 

32. The apparatus of Claim 1 wherein when said synchronization 
status of one of said standby and normal processors is not set, when said one of said 
vital inputs of the other one of said standby and normal processors is set, and when 
said one of said normal and standby processors, respectively, verifies through said 
means for communicating of said normal and standby processors, respectively, that 
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said standby processor disagrees with said normal processor, said at least one of said 
some of said vital outputs is disabled. 

33. A hot standby method comprising: 
employing a normal processor; 
employing a standby processor; 

with each of said normal and standby processors: 
employing a plurality of vital inputs, 
electrically interconnecting at least some of said vital 

inputs with at least some of said vital inputs of the other one of said standby and 

normal processors, 

employing a plurality of vital outputs, 
communicating with the other one of said standby and 

normal processors, 

providing a health status after communication is 
established with the other one of said standby and normal processors, 

employing a vital relay including an input controlled by 
one of said vital outputs and an output to one of said vital inputs of the other one of 
said standby and normal processors, 

providing a synchronization status associated with said 
communicating with the other one of said standby and normal processors, and 

employing an application routine for outputting said 
vital outputs when said synchronization status is set and inputting said vital inputs; 

employing with said standby processor a reset routine, which 
resets said standby processor when said health status of said standby processor is not 
provided; and 

outputting from some of said vital outputs of said normal 
processor and from some of said vital outputs of said standby processor. 

34. The method of Claim 33 further comprising 
operating said normal and standby processors in a mode 

wherein both of said normal and standby processors output through at least one of 
said some of said vital outputs of said normal and standby processors, respectively, 
without restriction; and 
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enabling said some of said vital outputs of said normal and 
standby processors, respectively, if the output of said vital relay of said standby and 
normal processors, respectively, is set and if said normal and standby processors, 
respectively, determine said health status. 

35. The method of Claim 33 further comprising 

operating said normal processor in a mode to output through at 
least one of said some of said vital outputs of said normal processor without 
restriction; and 

operating said standby processor in a mode to verify through 
said communicating that said standby processor agrees with said normal processor 
before outputting through at least one of said some of said vital outputs of said 
standby processor and, otherwise, resetting said standby processor. 

36. The method of Claim 35 further comprising 
enabling said some of said vital outputs of said normal 

processor if the output of said vital relay of said standby processor is set and if said 
normal processor determines said health status. 

37. The method of Claim 35 further comprising 

enabling one of said some of said vital outputs of said standby 
processor if the output of said vital relay of said normal processor is set, if said 
standby processor determines said health status, and if said standby processor verifies 
through said communicating that said one of said some of said vital outputs of said 
standby processor agrees with a corresponding one of said some of said vital outputs 
of said normal processor. 

38. The method of Claim 33 further comprising 
operating said normal and standby processors in a mode 

wherein both of said normal and standby processors verify through said 
communicating that said normal and standby processors, respectively, agree with said 
standby and normal processors, respectively, before outputting through at least one of 
said some of said vital outputs of said normal and standby processors, respectively, 
and, otherwise, resetting said normal and standby processors. 
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39. The method of Claim 38 further comprising 

enabling one of said some of said vital outputs of said normal 
and standby processors, respectively, if the output of said vital relay of said standby 
and normal processors, respectively, is set, and if said normal and standby processors, 
respectively, determine said health status, and if said normal and standby processors 
verify through said communicating that said one of said some of said vital outputs of 
said normal and standby processors, respectively, agrees with said standby and 
normal processors, respectively. 

40. The method of Claim 33 further comprising 
operating said normal and standby processors in a mode 

wherein both of said normal and standby processors verify through said 
communicating that said normal and standby processors, respectively, agree with said 
standby and normal processors, respectively, before outputting through at least one of 
said some of said vital outputs of said normal and standby processors, respectively, 
and, otherwise, resetting said normal and standby processors. 

41 . The method of Claim 33 further comprising 

employing a vital OR circuit having a first input from one of 
said some of said vital outputs of said normal processor, a second input from one of 
said some of said vital outputs of said standby processor, and an output adapted to 
output to a single output device. 

42. The method of Claim 33 further comprising 

forming an interlocking control system with said normal and 

standby processors. 

43. The method of Claim 33 further comprising 
periodically exchanging health information between said 

standby and normal processors, respectively, in order to provide said health status 
when said one of said vital inputs of the other one of said standby and normal 
processors is set and said health information is periodically received. 

44. The method of Claim 43 further comprising 

ignoring said reset command when said synchronization status 

is not set. 
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45. The method of Claim 33 further comprising 

outputting said vital outputs: (a) when said one of said vital 
inputs of the other one of said standby and normal processors is not set; and (b) when 
said one of said vital inputs of the other one of said standby and normal processors is 
set and said synchronization status is set. 

46. The method of Claim 33 further comprising 

setting said one of said vital inputs of both of said normal and 
standby processors; and 

verifying through said communicating that said standby 
processor disagrees with said normal processor before outputting through at least one 
of said some of said vital outputs of said standby processor, and responsively resetting 
said standby processor. 

47. A method for providing normal and standby processors, said 
method comprising: 

employing a normal processor; 
employing a standby processor, 
with each of said normal and standby processors: 
employing a plurality of vital inputs, 
electrically interconnecting at least some of said vital 
inputs with at least some of said vital inputs of the other one of said standby and 
normal processors, 

employing a plurality of vital outputs, 
communicating with the other one of said standby and 

normal processors, 

providing a health status after communication is 
established with the other one of said standby and normal processors, 

employing a vital relay including an input controlled by 
one of said vital outputs and an output to one of said vital inputs of the other one of 
said standby and normal processors, 

providing a synchronization status associated with said 
communicating with the other one of said standby and normal processors, and 
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employing an application routine for outputting said 
vital outputs when said synchronization status is set and inputting said vital inputs; 

employing with said standby processor a reset routine, which 
resets said standby processor when said health status of said standby processor is not 
provided; 

outputting from some of said vital outputs of said normal 
processor and from some of said vital outputs of said standby processor; and 

disabling said some of said vital outputs of said standby 
processor if the output of said vital relay of said normal processor is set. 



